The Overlooked Risk
Between 2025 and 2026, China-based threat actors known as "Fire Ant" compromised Cisco IOS XR routers to gain persistent, infrastructure-level access across multiple organizations. These attackers didn't stop at the initial breach. They used the routers to capture traffic, harvest credentials from TACACS+ authentication servers, and map trust relationships between environments. The campaign extended beyond the initially compromised organizations, leveraging infrastructure connections to infiltrate third-party networks and critical infrastructure.
Fire Ant deployed custom malware specifically designed for router control, modified firewall rules to conceal their activity, deleted logs, and maintained multiple network vantage points. As Sygnia's director of incident response, Asaf Perlman, stated, "Fire Ant didn't just compromise systems. It compromised the trust layer those systems depend on."
Timeline of the Attack
2022-2024: Google Cloud's Mandiant tracks UNC3886 targeting strategic organizations.
2025: Sygnia publishes initial Fire Ant research documenting hypervisor compromises.
2025 (September-December): Palo Alto Networks Unit 42 and federal cyber defense agencies warn of attacks on Cisco Adaptive Security Appliances by China-based actors.
2026: Fire Ant evolves tactics, focusing on Cisco IOS XR routers and TACACS+ servers, impacting both direct victims and third-party environments through infrastructure relationships.
Missing or Failed Controls
Asset Inventory and Classification: Routers and network infrastructure devices weren't treated as critical security assets. They lacked the monitoring, hardening, and incident response coverage given to endpoints or servers.
Continuous Monitoring: The compromised routers were outside standard security tool coverage. Traffic capture, credential harvesting, and malware deployment occurred without triggering alerts.
Authentication Security: TACACS+ servers were compromised without detection, allowing credential harvesting as administrators used them.
Log Integrity and Retention: Attackers deleted logs and manipulated firewall rules. Your team had no mechanism to detect log tampering or maintain immutable audit trails for infrastructure devices.
Network Segmentation Validation: Trust relationships between environments weren't continuously validated. Fire Ant exploited these relationships to pivot from compromised infrastructure to third-party networks.
Forensic Readiness: Routers lacked the logging depth, evidence preservation, and forensic tooling necessary for effective investigation when incidents were discovered.
What Standards Require
NIST SP 800-53 CM-8 requires maintaining a current inventory of system components, including network infrastructure, and designating individuals responsible for managing that inventory. It specifically calls out "information system components that are part of the system boundary."
CIS Controls v8.1, Control 1.1 mandates maintaining an accurate, detailed, and up-to-date inventory of all technology assets with the potential to store or process data, explicitly including network devices. Control 12.4 requires establishing and maintaining a secure network architecture, with documented network boundaries and trust relationships.
NIST SP 800-53 AU-6 requires reviewing and analyzing system audit records for inappropriate or unusual activity. AU-9 mandates protecting audit information and tools from unauthorized access, modification, and deletion. Fire Ant's ability to delete logs and modify firewall rules represents a direct failure of both controls.
NIST SP 800-53 AC-2 requires monitoring system accounts, including those used for authentication infrastructure. When TACACS+ servers are compromised and harvesting credentials in real-time, you've lost visibility into which administrative actions are legitimate.
ISO/IEC 27002 Control 8.16 states that networks, systems, and applications should be monitored for anomalous behavior, and appropriate actions should be taken to evaluate potential information security incidents. Infrastructure devices require the same monitoring rigor as any other system component.
Lessons and Action Items for Your Team
Inventory Your Trust Infrastructure: List every router, hypervisor, TACACS+ server, RADIUS server, and management host that sits between environments. Document which credentials they hold, what traffic they can see, and which networks they can reach. If you can't enumerate these systems in the next 30 minutes, you don't know your attack surface.
Extend Monitoring Coverage to Infrastructure: Deploy the same detection capabilities to routers and network devices that you apply to endpoints. Implement syslog forwarding with integrity checking. If your SIEM doesn't ingest router logs or your Endpoint Detection and Response equivalent doesn't cover network infrastructure, you're blind to infrastructure-level compromise.
Validate Trust Relationships Continuously: Map every connection between your environment and third-party networks. Document which systems have reachability across boundaries. Schedule quarterly reviews, but implement automated checks for unexpected changes in routing tables, firewall rules, and authentication configurations.
Harden Authentication Infrastructure as Critical Assets: TACACS+ and RADIUS servers are single points of failure for administrative access. Implement multi-factor authentication for infrastructure administration, restrict management plane access to jump hosts, and monitor authentication server logs for credential harvesting patterns.
Build Forensic Readiness into Infrastructure Devices: Configure routers to forward logs to immutable storage before local deletion is possible. Implement configuration change detection with alerting. Maintain known-good firmware hashes and validate them regularly. When an incident occurs, you need evidence that survives attacker cleanup.
Test Incident Response Procedures Against Infrastructure Compromise Scenarios: Run a tabletop exercise assuming your routers are compromised and your logs have been tampered with. Can your team detect the compromise? Do you have alternative evidence sources? Can you rebuild trust in your network after an infrastructure-level breach?
The Fire Ant campaign shows that sophisticated actors have moved past endpoint-focused attacks. They're targeting the infrastructure that creates trust, reachability, and visibility across your environment. Your routers aren't legacy technology you can ignore. They're the vantage points from which attackers observe your entire operation.
